oscp/Necronomicon/Windows/Important Locations.md

• Registry
  • WDigest enable
    • HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
    • Set to "1"
  • LSA Secrets
    • HKLM\SECURITY\Policy\Secrets
    • Accounts found here:
      • Domain Computer Account
        • Changes every 30 days, can be used to generate Silver ticket or perform RBCD attack
      • Autologon
        • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • DPAPI master keys
  • Applocker rules - HKLM\Software\Policies\Microsoft\Windows\SrpV2
  • Restricted admin - HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin